13 ms·
FTC takes action against GoDaddy for alleged lax data security
- josefritzishere 2y agoI never thought I'd be a fan of a government agency. But here we are.
- coldpie 2y agoPress release is dated Jan 15. The folks who made this happen are gone now. If you'd like to see what the new admin's FTC is spending your tax dollars on instead of this, take a look here: https://www.ftc.gov/news-events/news/press-releases https://www.ftc.gov/news-events/news/press-releases
- jjtheblunt 2y agoWhy do you think they’re gone now? (Sounds like hyperbole, as it’s not like non political people just all got replaced.)
- grajaganDev 2y agoFederal employees are being asked who they voted for. This is not hyperbole.
- zelphirkalt 2y agoIs the US turning into "fourth Reich"?
- alistairSH 2y agoMy hopes aren't high at this point. Trump and the GOP are hellbent on implementing all of the P2025 agenda - many of the flurry of Eos this week were either literally cribbed from the P2025 document or strongly appear to AI-generated adaptations of the same. Give it 6-12 months and we'll see how the courts react to challenges and if Congress suddenly grows a spine. And if a mid-term swing back to normalcy seems likely.
- insane_dreamer 2y agoLuckily we have enough remaining guardrails that it's unlikely to happen within the next 4 years. But we're getting closer, that's for sure. And the Supreme Court's disastrous decision on presidential immunity is allowing Trump to play Generalissimo.
- mrguyorama 2y agoWhat guardrails are you talking about? Even ignoring the presidential immunity ruling that explicitly makes him Fuhrer, if Trump has ICE arrest all brown people tomorrow, what exactly is going to stop him? The courts? A judge can say whatever the hell they want from their bench, it won't stop an ICE agent from physically forcing you onto a C130 and taking you wherever. Trump already "deported" legal american citizens his first term. Trump supporters openly insist on "deporting" a legal american citizen who dared to tell Trump that he's a meany. The Constitution is just a piece of paper. None of the people in the Trump admin care about it or respect it. It will not save us. The guardrails are all gone.
- insane_dreamer 2y agoI guess I've still been somewhat hopeful that the Legislative and Judicial branches will do their job and curb the worst of Trump's excesses or power grabs. But you're right that it's not looking good so far with the GOP Senate seeming to allow anything Trump wants so far. Hesgeth's confirmation was a really bad sign. And you're right, ICE could well be on its way to turning into the Stasi.
- datavirtue 2y ago10% from each party support deporting legal immigrants.
- pbhjpbhj 2y agoSource?
- datavirtue 2y agoDon't anger Orange Adolf.
- gtgvdfc 2y ago[flagged]
- grajaganDev 2y agoI am not sure what you mean by falsified but is this OK? https://www.independent.co.uk/news/world/americas/us-politics/trump-civil-service-loyalty-transition-b2678674.html https://www.independent.co.uk/news/world/americas/us-politic... "Incoming senior Trump administration officials have begun questioning career civil servants who work on the White House National Security Council about who they voted for in the 2024 election, their political contributions and whether they have made social media posts that could be considered incriminating by President-elect Donald Trump's team, according to a U.S. official familiar with the matter." That those charged with national security are culled for lack of loyalty should be very concerning - even to those who voted for this person.
- gtgvdfc 2y ago[flagged]
- grajaganDev 2y agoI am considering this in the context of 1930's history.
- gtgvdfc 2y agoGood for you! Myself, I agree with you that Chamberlain is a great model to understand Trump. Pretends to be a pacifist while buying time to strengthen the national economy to fight a big war everyone knows is inevitable because everyone wants it. FDR is also a great model for Trump to understand the political levers to crush both an unelected and disloyal deep state and legitimate opposition. However, may I also recommend you read a history book that doesn't bracket the world wars?
- insane_dreamer 2y ago> So Trump is demanding loyalty from the members of the National Security Council. Not the FTC. Not the DOE. No. He's demanding loyalty from everyone.
- coldpie 2y agoChange "gone" to "out of power," if you like. The FTC Chair controls the agency's agenda, and the Chair switched parties last week.
- gs17 2y agoThe new chair was nominated for the FTC (as a commissioner, not chair) by Biden.
- coldpie 2y agoYes, and?
- tzs 2y agoBy law the FTC, like the FCC, cannot have more than 3 commissioners from the same party. When there is an opening and there are already 3 from the President's party traditionally the President asks the Senate leader of the other party who should be nominated and the Senators of the President's party do not vote against that nominee.
- stronglikedan 2y ago[flagged]
- andybak 2y agoTotal dissolved solids? Technical Documentation Services? Time-driven switching?
- tjpnz 2y ago>NOTICE: The FTC website is currently unavailable. Thank you for your patience while we work to restore service.
- gs17 2y agoIt's back up, the only real announcements listed from the new administration are Ferguson as chair and anti-DEI changes (including a 2-1-2 vote to allow it where "Commissioners Rebecca K. Slaughter and Lina M. Khan did not participate.")
- DemetriousJones 2y agoLatest press release: "FTC Grants Chairman Ferguson Authority to Comply with President Trump’s Orders to End DEI"
- jmuguy 2y agoI guess its just the power of advertising but its amazing to me that GoDaddy continues to be a popular solution for hosting, domain registration, etc given their absolute toilet of a reputation.
- deleted 2y ago[deleted]
- lenerdenator 2y agoThey got their product out. Who else is there that the average person would know about?
- grajaganDev 2y agoYup they dominate mindshare. And their UI for choosing a domain name is excellent.
- bogwog 2y agoSquarespace advertises a lot too, probably more than GoDaddy nowadays, and they are also a domain registrar. Maybe GoDaddy just sells themselves better? I see Squarespace as kind of an amorphous boring blob of internet business services.
- Linkd 2y agoSquarespace is not 'tagged' in my brain under the "domain registrar" category yet. When I blindly think of domain registrars, as much as I dislike them, Godaddy is the first to come to mind.
- stronglikedan 2y agoSquarespace positions themselves as a website builder more than a registrar. In fact, I doubt the average person would even realize they are a registrar, since that is abstracted away in the website building process.
- stronglikedan 2y ago
- ziddoap 2y agoIt's amazing that (approximately) no one cares about stuff like this. GoDaddy was severely breached several times over several years, yet they still rake in billions of revenue from their millions of customers. Now they have to pay someone to fill out a biennial checklist and... promise to not lie. Awesome. If you own a company, why even bother with security? Security is expensive. Wait until a breach is exposed, offer $10 credit monitoring (at best), accept the free press coverage, maybe pinky promise to not lie if you've been particularly egregious in your handling of multiple incidents, and then carry on like normal. (This is tongue-in-cheek, I work in security, but I am frustrated with how often stories like this one occur)
- stackskipton 2y ago>If you own a company, why even bother with security? Security is expensive. Wait until a breach is exposed, offer $10 credit monitoring (at best), accept the free press coverage, maybe pinky promise to not lie if you've been particularly egregious in your handling of multiple incidents, and then carry on like normal. (This is tongue-in-cheek, I work in security, but I am frustrated with how often stories like this one occur) As SRE, I've heard executives say this "There is no penalty for breaches, why care?"
- reaperducer 2y agoAs SRE, I've heard executives say this "There is no penalty for breaches, why care?" Depends on the industry. I'm in healthcare, and our legal department is always reminding the devs that even a small breach can be financially catastrophic for the company, as they are totaled as $xx,000 per person affected. We get training on it every six months.
- stevenicr 2y agoI'd like to hear more about this training - I have started to put together some resources to teach C suite, maybe new-to-the-field lawyers, other interested stakeholders - about website compliance issues.. looking to mimic other good training / learning materials, extra info to consider, maybe collab and send business I can't take on, etc.
- tkems 2y agoI was shocked when I purchased a domain recently on GoDaddy (I normally use Cloudflare or AWS) and noticed that they have an 'upsell' with more security options (MFA and some other features) for something like $10/yr. Why wouldn't they want their customers to be more secure by default? To me it just reeks of money-grabbing for people that are none the wiser.
- grajaganDev 2y agoIt is outrageous and irresponsible to charge for MFA. It show a cavalier attitude toward the greater security of the internet.
- Terretta 2y agoSame for OIDC (and even traditional SAML SSO). If every stolen or potentially stolen credential was billed to the breached provider at even $100/account*, SSO would become free so fast your head would spin. Every credential in the provider's DB would be correctly seen as a liability. * Arguably the number should be higher and contribute to a infosec response, detection, and preventative measures warchest. Though, ultimately, this would probably just enrich cybersecurity insurance firms.
- grajaganDev 2y agoAgreed. Another example is Microsoft charging extra for enhanced logging. This came to light during the SolarWinds debacle.
- philsnow 2y agoNot exactly the same but this reeks of https://sso.tax https://sso.tax.
- fastball 2y agoWhy did you purchase a domain on GoDaddy if you know better?
- insane_dreamer 2y agoI can't believe GoDaddy is still in business. Shows you can be a horrible company -- borderline scammy back in the day -- and somehow survive. FWIW we've used Gandi for years and very happy with it.
- thinkingtoilet 2y agoThe power of advertising and first-mover advantage. Outside of the tech space, people really only know of godaddy if they want to buy a domain.
- msikora 2y agoMarketing and large captive audience.
- akurtzhs 2y agoI used Gandi for a long time and switched after they were bought out and registration prices started rising. HN article from 2023 - https://news.ycombinator.com/item?id=35080777 https://news.ycombinator.com/item?id=35080777 After that I've used spaceship.com, NameCheap's rebrand, without complaint and most recently porkbun.com due to support in dnscontrol.
- josefresco 2y agoIf you think GoDaddy is the most terrible, you have never been exposed to the hell that is Network Solutions. GoDaddy is big, safe and terrible. Network Solutions is big, safe and even worse.
- nnf 2y agoI can't pass by this comment about Network Solutions without an enthusiastic second. Several times per month I help various customers with their domains, and when I see that one is with Network Solutions, I know I'm going to have to waste a bunch of time with their terrible DNS editor and will have to wait around for at least 20 minutes before their own editor reflects the changes I've made. The worst part is that when replacing an A record with a CNAME, it lets you delete the A record but then blocks you from adding the CNAME, because "a record with that name already exists" (referring to the one that was just deleted). This is where the 20+ minute wait changes from "inconvenient" to "downtime". It's been like this for at least 15 years.
- datavirtue 2y agoYou just brought back a fifteen year old memory. I have used a lot of hosting services but have always avoided GoDaddy. The name sounded too playful...and that was after being a Host Gator customer for years. They were decent back in the day and let me serve rediculous amounts of data from a shared hosting tier that always performed well...I was probably the noisy neighbor.
- b112 2y agoI can't believe they still exist. I remember having to fax my changes to them, pre-2000, when they were the only game in house. Crazy.
- rybosworld 2y agoYears ago, before I was very computer literate, my friend turned me onto Network Solutions for hosting. Long story short I got locked out of my account. It truly seemed like the support didn't want to help me get back in. This went for what felt like forever but was probably just a few weeks. I never got a resolution and was never able to log back in to my account. I eventually did a chargeback because I couldn't use a service that I was paying for. They were all of a sudden proactive about reaching out - with an accusatory email nonetheless. In their view, the chargeback was fraudulent.
- ivoflipse 2y agoIn related news, their ISO 27001 certificate just expired. Seems in line with their overall security posture then https://img1.wsimg.com//Sitecore/6/1/registrar-iso27001-certificate.pdf https://img1.wsimg.com//Sitecore/6/1/registrar-iso27001-cert...
- goalieca 2y agoISO 27001 doesn’t mean secure. It does mean they have invested money in compliance though.
- honestSysAdmin 2y agoA good law would be that if a customer's data is leaked, any and all revenue that was made with/through that customer must be returned to the customer. All of a sudden companies will magically remember how to do half-way sober IT again.
- JoshTko 2y agoThis would be awesome, few if any companies would be able to take the risk of storing customer info, since they would need very good security, and very good reason for every piece of data they store, and insurance to cover themselves in case they do lose your data. In fact companies would go out of their way to not store any of your data.
- honestSysAdmin 2y ago> since they would need very good security As someone with 20+ years experience in IT/DevOps/Cloud/whatever, I disagree. They would simply need to actually use the security that is already there. Data leaks that happen due to lack of "very good security" are extremely rare. In almost every case, someone was doing something very stupid that everyone already agrees is a very obvious thing to not do. . > In fact companies would go out of their way to not store any of your data. The companies that already use existing IT systems, as they are already designed to be used, have no problem protecting customer data and not leaking it. The companies that can not properly hire our outsource competent IT people shouldn't be storing data in the first place. Commerce is subject to regulation, due to human nature, and different regulation is needed today. . > and insurance to cover themselves in case they do lose your data I would prefer that this kind of insurance not exist.
- sethammons 2y agoSendGrid, pre IPO, had a GoDaddy security incident: someone social engineered one of the GoDaddy support reps into giving them control of our domain. We were able to re-secure the domain before the attacker fully locked us out. They could have powned all of our email links.
- maxclark 2y agoThe FTC action is because GoDaddy claimed to have security when they didn’t - not because they didn’t have security in the first place. Subtle but important difference. Also the remedies include having a complete security program within 90 days IIRC, on what world would anyone think that’s remotely possible? They wouldn’t even have an RFP drafted in 90 days.
- asr 2y agoGoDaddy will have known of this investigation since it began—probably for years. So it’s 90 days from now(ish), but they (should) have gotten a head start.
- thomas4151 2y ago[flagged]
- ycombinatrix 2y agoCan someone flag this scam comment please? Thanks
- defrost 2y agoeasy peasy: https://www.youtube.com/watch?v=ImAlx0amAIc https://www.youtube.com/watch?v=ImAlx0amAIc
- calibas 2y agoGoDaddy is one of the sleaziest companies I know of. I ran a website hosted on GoDaddy for a local business when the server cluster was hacked. GoDaddy admitted it was their fault, but the business ended up having to pay me to fix the site. GoDaddy also managed to convince the business to pay for an additional monthly "security" plan, which included page caching. They set everything up over the phone without talking to me at all. The next day I notice some odd behavior with the admin pages, then realize they're being cached, not only that but they're now publicly accessible. GoDaddy's improved security plan ended up being responsible for a data leak. They really screwed up twice but there was zero penalty, the only consequence was they made more money. The business chose to stay with GoDaddy, despite my recommendations. They saw the ads on TV and were convinced GoDaddy is the pinnacle of web hosting. Also, check this out: https://www.butterflyave.com/ https://www.butterflyave.com/ Those assholes have parked my old business name, and want to sell it back to me for $1,499.
- brikym 2y agoThey seem to park so many domains it wouldn't surprise me if they park new domains based on domain searches. There is a clear motivation there so I always run whois in the terminal instead of searching on any domain registrar with the exception of cloud providers who don't make much of their money from domains.
- jmholla 2y agoI've definitely heard stories of people saying GoDaddy grabbed their domain right after they searched it. There's almost always someone following those stories saying that it was just coincidental. I have zero trust in GoDaddy. I remember when I was kid using their service because my grandparents had bought a website and hosting services through them and they wanted me to create the site. Their interface was so confusing and I felt like I suddenly had no understanding of how computers work. Fast forward to today, and yes, past me was not very knowledgeable, but not to the degree their site made me feel. They use custom terminology for industry standard things, group things together in weird locations, and have so many dark patterns. My point: sleazy tactics like domain front-running would honestly be on brand. I tell people not to use GoDaddy and definitely not for domain searching.
- yooo000 2y agoMoved all my domains to porkbun last year...could not be happier!
- noobermin 2y agoTime for GoDaddy's CEO to book a few rooms at Trump Hotel in DC.
- dikaio 2y agoThey should be looking into them for buying up all the competitors in domain selling. The bought two of the biggest competitors Dan.com and unregistery. Dan.com charge 9% on a sale of a domain now godaddy is charging 30%. Completely different company since Bob Parsons sold to a couple private equity firms.
- ficklepickle 2y agoAre there any security related accreditations for a company that are worth more than the paper they are(n't) printed on?
- james4151 2y agoFirstly, I would say spyrecovery36 @ gm ail com is the only hacker you can go to for positive outcome here. Customer service is great. After reading great reviews about him on almost all the websites i researched on, I hired him to hack my cheating spouse's iPhone 14 and trust me when i say he hacked the device and gave me full access to his phone. His services were cost effective, top notch and easy to use. I highly recommend this hacker for any hacking services. Pay for the use of his services and avoid scam stories. stay safe